@cratis/pi 7.20.0 → 7.22.0

package/package/corpus/rules/concepts.md

@@ -64,15 +64,23 @@ public record AuthorName(string Value) : ConceptAs<string>(Value)
 ## Chronicle stream identity rules
 
 ```csharp
-public record AuthorId(Guid Value) : EventSourceId<Guid>(Value)
+public record AuthorId(Guid Value) : EventSourceId<Guid>(Value), IGeneratable<AuthorId>
 {
-    public static AuthorId New() => new(Guid.NewGuid());
+    public static AuthorId New() => new(GenerateValue.Uuid());
     public static implicit operator AuthorId(Guid value) => new(value);
 }
 ```
 
 - `New()`, primitive → derived ID conversion, and sentinels are optional domain
   conveniences; `EventSourceId<T>` does not create an arbitrary derived type.
+- When the system creates the value, implement `IGeneratable<TSelf>` and use
+  `GenerateValue.Uuid()` (or `GenerateValue.UuidV7()` when index locality
+  matters), both from `Cratis.Concepts` in Cratis.Fundamentals 7.23.0 or later.
+  Never `System.Random`. A client-supplied identifier is an input, not something
+  to generate; see the **cratis-fundamentals-concept** skill.
+- Arc and Chronicle can resolve an older Cratis.Fundamentals. Check the resolved
+  version first; if it is below 7.23.0, add a direct `Cratis.Fundamentals`
+  7.23.0 or later reference, or keep the existing `static New()` (without the interface) until you can.
 - The exact `EventSourceId<T>` base supports conversions among its underlying
   `T`, string, typed ID, and untyped `EventSourceId`, but those operators do not
   construct your derived domain record from every source form.

package/package/corpus/rules/vertical-slices.md

@@ -54,10 +54,10 @@ Every domain identifier or named value is a typed record — raw `string`/`Guid`
 - **[contract] Chronicle stream identities** derive from `EventSourceId<T>` with an `IComparable` underlying primitive. Add `NotSet`, `New()`, or a `T` → derived-id operator only when the domain API justifies it; typed empty/zero values are real specified stream IDs. The base conversion surface does not construct every derived domain record automatically.
 
 ```csharp
-public record AuthorId(Guid Value) : EventSourceId<Guid>(Value)
+public record AuthorId(Guid Value) : EventSourceId<Guid>(Value), IGeneratable<AuthorId>
 {
     public static readonly AuthorId NotSet = new(Guid.Empty);
-    public static AuthorId New() => new(Guid.NewGuid());
+    public static AuthorId New() => new(GenerateValue.Uuid());
     public static implicit operator AuthorId(Guid value) => new(value);
 }
 
@@ -67,6 +67,8 @@ public record AuthorName(string Value) : ConceptAs<string>(Value)
 }
 ```
 
+`IGeneratable<T>` and `GenerateValue` need Cratis.Fundamentals 7.23.0 or later. Arc and Chronicle can resolve an older version; add a direct reference or keep a plain `static New()` until then (see [concepts.md](./concepts.md)).
+
 **[convention] Placement:** slice-specific concept → in the slice file; feature-shared → feature folder; module-shared → module folder; app-wide → `Common/`. Scan `Common/` and the feature folder before creating a new concept. See [concepts.md](./concepts.md) for full patterns, or invoke the **cratis-fundamentals-concept** skill.
 
 ## Commands

package/package/corpus/skills/cratis-fundamentals-concept/SKILL.md

@@ -15,7 +15,7 @@ This skill is verified against these exact public releases:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Fundamentals` | `7.19.2` | `Cratis.Concepts.ConceptAs<T>` |
+| `Cratis.Fundamentals` | `7.23.0` | `Cratis.Concepts.ConceptAs<T>`, `IGeneratable<TSelf>` and `GenerateValue` |
 | `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Events.EventSourceId` and `EventSourceId<T>` |
 
 Reverify product sources before claiming support for another version.
@@ -76,6 +76,55 @@ A `NotSet` or `Empty` value is optional domain policy. Add one only when the
 chosen primitive value is impossible or explicitly reserved in that domain.
 Do not assume `string.Empty`, `0`, or `Guid.Empty` is universally invalid.
 
+## Let a concept generate its own value
+
+Check the Cratis.Fundamentals version the project resolves first. Arc and
+Chronicle can bring an older one; when it is below 7.23.0, add a direct
+`Cratis.Fundamentals` 7.23.0 or later package reference, or keep the existing
+`static New()` (without the interface) until you can.
+
+When the system, not the caller, creates a value, the concept declares how by
+implementing `IGeneratable<TSelf>` (`Cratis.Concepts`, Cratis.Fundamentals
+7.23.0 or later). The interface requires `static abstract TSelf New()`, so
+generic code constrained on `where T : IGeneratable<T>` calls `T.New()` without
+reflection. Generate a UUID with `GenerateValue`, never with `Guid.NewGuid()` in
+scattered call sites and never with `System.Random`:
+
+```csharp
+using Cratis.Concepts;
+
+public record <ConceptName>(Guid Value) : ConceptAs<Guid>(Value), IGeneratable<<ConceptName>>
+{
+    public static <ConceptName> New() => new(GenerateValue.Uuid());
+}
+```
+
+Both helpers return a `Guid` with the RFC 9562 variant and fill their random
+bits from `RandomNumberGenerator`:
+
+- `GenerateValue.Uuid()` — version 4, 122 random bits. The default.
+- `GenerateValue.UuidV7()` — version 7: Unix-epoch milliseconds first, then 74
+  random bits. Choose it only when database index locality or rough creation
+  order matters, after checking how the database stores and compares UUIDs. It reveals the creation time, it is **not** monotonic within a
+  millisecond, and clock adjustments can reorder values.
+
+Neither helper guarantees uniqueness; a collision is extremely unlikely, not
+impossible. `IGeneratable<TSelf>` is not limited to Guid-backed concepts, but
+`GenerateValue` only produces UUIDs.
+
+Do not generate when:
+
+- The client supplies the identifier. It is an input; keep it.
+- The value must be secret or authenticate someone. A UUID is an identifier,
+  not a token; use a dedicated secure-token API.
+- The same input must yield the same value. Random generation is not
+  idempotency; derive the value deterministically, or persist and reuse the
+  first one.
+
+In specifications, construct the concept from a known value
+(`new <ConceptName>(Guid.Parse("…"))`) and assert against it. Do not seed or
+replace the generator. Guide: `/fundamentals/csharp/generating-values/`.
+
 ## Create a Guid-backed Chronicle stream identity
 
 Use this shape only for an identity actually supplied to Chronicle append/read
@@ -86,6 +135,7 @@ operations as the event-source ID.
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
 using Cratis.Chronicle.Events;
+using Cratis.Concepts;
 
 namespace <NamespaceRoot>.<Feature>;
 
@@ -93,13 +143,13 @@ namespace <NamespaceRoot>.<Feature>;
 /// Represents the event-source identity of a <description>.
 /// </summary>
 /// <param name="Value">The underlying Guid value.</param>
-public record <ConceptName>(Guid Value) : EventSourceId<Guid>(Value)
+public record <ConceptName>(Guid Value) : EventSourceId<Guid>(Value), IGeneratable<<ConceptName>>
 {
     /// <summary>
     /// Creates a new <ConceptName>.
     /// </summary>
     /// <returns>A new <ConceptName>.</returns>
-    public static <ConceptName> New() => new(Guid.NewGuid());
+    public static <ConceptName> New() => new(GenerateValue.Uuid());
 
     /// <summary>
     /// Converts a Guid to a <ConceptName>.
@@ -108,8 +158,8 @@ public record <ConceptName>(Guid Value) : EventSourceId<Guid>(Value)
 }
 ```
 
-`New()` and the primitive-to-derived conversion are conveniences on this domain
-type. `EventSourceId<T>` does not construct an arbitrary derived identity for
+`New()` (through `IGeneratable<TSelf>`) and the primitive-to-derived conversion
+are conveniences on this domain type. `EventSourceId<T>` does not construct an arbitrary derived identity for
 you.
 
 ## Create a non-Guid Chronicle stream identity
@@ -185,6 +235,9 @@ repository structure.
 - `ConceptAs<T>` and `EventSourceId<T>` use an `IComparable` underlying type.
 - A concept contains exactly one wrapped value and no extra properties.
 - Enums remain enums.
+- A concept that creates its own value implements `IGeneratable<TSelf>`; a
+  Guid-backed one uses `GenerateValue`, not `Guid.NewGuid()` or `Random`.
+  Client-supplied, secret or idempotent values are not generated.
 - Null absence uses a nullable concept reference rather than a null wrapped
   value.
 - Primitive-to-derived conversions and sentinels exist only when justified by

package/package/corpus/skills/cratis-fundamentals-concept/verification.json

@@ -3,6 +3,9 @@
   "input": "Create a strongly typed value for a domain concept.",
   "fixtures": [],
   "assertions": [
-    { "kind": "skill-contains", "value": "ConceptAs<T>" }
+    { "kind": "skill-contains", "value": "ConceptAs<T>" },
+    { "kind": "skill-contains", "value": "IGeneratable<TSelf>" },
+    { "kind": "skill-contains", "value": "GenerateValue.Uuid()" },
+    { "kind": "skill-contains", "value": "not** monotonic within a" }
   ]
 }

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -28,10 +28,15 @@ identity, effect and pending-work contract at that point; do not postpone it to
   4.66.0). Probed on 3.28.2: the complete examples are `executableReady`. A cratis bundle before 3.28.2
   (4.60.1) reports PLAY0268 at binding: report "V3 blocked: PLAY0268 (ESM v6)" and
   name the tool, never remove them.
-- No MCP tool, `validate` or render runs Automation or Translate specs. V4 is "not run: no route".
-- Stage 4.24.2 (bundled in cratis 3.28.3) renders no Automation or Translate slice (Stage#79); `cratis render` refuses the whole v6 model with STAGE-ESM-016: the whole automation is
-  gap-fill or hand-written delivery with the model as contract (`references/realization-and-gap-fill.md`).
-- Invoked commands run with no caller; `.play` cannot name an actor (Screenplay#383).
+- Standalone 4.125.0 runs admitted scenarios through `screenplay test` or MCP
+  `run-specifications`; source validation and render publication do not run V4.
+- Stage 4.51.3 refuses Automation/Translate members with STAGE-ESM-024; its direct
+  planner audits through v7. Deliver that scope as authorized gap-fill
+  (`references/realization-and-gap-fill.md`).
+- Reaction `runs as system role "<Role>"` declares an invocation actor (ESM v10).
+  Without it the invoke has no caller. CLI 3.41.0's 4.114.0 compiler rejects the
+  new syntax (PLAY0137). Checked model/diagnostics: captures-and-reactions
+  `references/invocation-identity.md`.
 
 ## Effect guarantees and recovery traps
 | Guarantee | What it promises | What can show it |
@@ -113,12 +118,12 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
    supersession), the work-item key and the recovery path. Direct reaction only for an immediate,
    internal, always-possible effect; say why no pending state is needed. A translation is not
    automatically infallible.
-4. **Effect and actor.** `produces <Fact>` when nothing should refuse the fact. `invokes <Command>`
-   when the step is a decision that may reject; it carries **no caller**, so gated commands reject it.
-   Record one actor decision: internal ungated command (only when safe and unreachable), direct
-   `produces`, or gated command with a trusted actor and the capability gap (Screenplay#383). The code
-   realization of the actor is a reactor with `[ExecuteCommandsAsSystem("<role>")]` and a policy
-   requiring that role; never invent `runs as`. Never strip authorization to pass a tool.
+4. **Effect and actor.** `produces <Fact>` records a decided fact; `invokes <Command>`
+   requests a decision. Keep its gate and declare the trusted role with reaction
+   `runs as system role "<Role>"` (ESM v10). An undeclared actor remains caller-less.
+   CLI/Stage realization is a separate gap; a returned-command reactor uses
+   `[ExecuteCommandsAsSystem("<role>")]` and the matching policy. Never strip a
+   gate or supply `given caller` as a fictional reaction identity.
 5. **Trace inputs.** Every trigger value, command input, event property and destination needs a
    supported source; every filter a business reason. Gaps are questions, not invented mappings.
 6. **Repetition and termination.** Identify one logical work occurrence and what a retry is. Guard the
@@ -140,7 +145,8 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
 - Clock triggers take no values (PLAY0450) and no `by` on reads (PLAY0443). `for each <View>` is
   reserved, not available.
 - Capture `when` cannot mix `and` and `or` (PLAY0089). A capture without `key` does not bind.
-- Undeclared events in capture `append` and `remove with` pass V1 and fail only at binding (V3, PLAY0273): run V3.
+- Current V1 warns on undeclared capture/removal events (PLAY0166); V3 remains a
+  separate binder check.
 - A trigger with `reads` that `produces` directly fails binding: decide in a command. `reads` never protects.
 - An authorized command exercised in a spec without `given caller` is PLAY0389 at binding.
 - A list query (`=> Item[]`) and a clock sweep that iterates items do not bind; show them only as marked
@@ -175,7 +181,8 @@ Never report a verdict without the tool and version that produced it.
 
 ## Verify
 - V1 and V3 per `cratis-screenplay-toolchain`, each with tool and version. On a cratis before 3.28.2
-  bundle report "V3 blocked: PLAY0268 (ESM v6)"; on 4.66.0 (standalone or cratis 3.28.2) these slices bind. V4 is "not run: no route" for these slices.
+  bundle report "V3 blocked: PLAY0268 (ESM v6)". Current admitted scenarios use
+  standalone `screenplay test`/MCP for V4; unsupported or unbound is not passed.
 - For each external source and type: its translation, or an explicit out-of-scope reason; check
   target-field completeness as well as source-field dispositions.
 - One happy path is not coverage: cite the spec or the missing case for each branch, denial, competing

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/audit-format.md

@@ -11,8 +11,8 @@ technique: partial work stays visible and nothing is skipped because it looked r
 
 Result is `complete` only when every column is filled or says why it does not apply (for example
 "direct effect: immediate, internal, cannot fail"). `open` names the unresolved decision and who
-answers. `blocked` names the capability gap (for example Screenplay#383 for the actor, or a
-list query that does not bind) with the intended behaviour.
+answers. `blocked` names the actual capability gap (for example CLI 3.41.0's
+older compiler cannot parse a declared ESM v10 reaction actor) with intended behavior.
 
 ## Per translation (capture or translator reaction)
 | Source and type | Location | Correlation | Field dispositions | Target fields traced | Dedup and ordering | Trust boundary | Recovery owner | Named cases | Result |
@@ -45,4 +45,5 @@ never skip it silently or call the chain complete.
 | Unreviewed | `RecordCompletion` denial for a non-coordinator is specified; query authorization not in scope | stated |
 
 Then the verdict line per `cratis-screenplay-toolchain`: tool and version on each of V1 to V4
-(V4 for these slices: "not run: no route").
+(V4 uses standalone `screenplay test` or MCP `run-specifications`; report the
+actual result, or a specific host/input limitation if not run).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/automation-patterns.md

@@ -65,16 +65,17 @@ When a todo list is not needed: the effect is immediate, internal and cannot fai
 | can it be refused? | only by append-time constraints | authorization, validation, `require`, constraints |
 | destination | `for` value; without `for`, the trigger fact's source | the command's identifier |
 | with trigger `reads` | fails binding (unprotected decision) | allowed; protection is the command's job |
-| caller | n/a | **none**: gated commands reject |
+| caller | n/a | declared reaction `runs as` actor (ESM v10), otherwise none |
 
 ## 4. The actor behind an invoke
-On Screenplay 4.66.0 there is no caller: the invoked command runs its full pipeline (authorization, validation,
-requirements, constraints) with no caller, a command that needs one rejects, and the rejection
-ends the scenario. Screenplay has no syntax for an identity (Screenplay#383, open); never invent
-`runs as` or a caller line. At code level the realization is a Chronicle reactor whose returned
-commands run as a trusted system actor: `[ExecuteCommandsAsSystem("<role>")]` (Arc, since
-v20.56.0; also in a Stage-rendered app, whose Arc is 22.25.0) with a policy that requires that
-role. Record the intended actor in the model; the attribute lives in gap-fill code.
+Screenplay 4.125.0 declares the actor with reaction-level `runs as system role
+"<Role>"` (ESM v10); without it a gated invocation has no caller and denies.
+`given caller` is not an invocation actor. Role requirements remain enforced;
+claim conditions for this system principal remain unknown. CLI 3.41.0's older
+compiler rejects the syntax (PLAY0137), and Stage 4.51.3 admits through v7 only.
+Use the checked model in captures-and-reactions `references/invocation-identity.md`.
+Arc gap-fill uses `[ExecuteCommandsAsSystem("<role>")]` for returned commands,
+not identity inferred from prose or an imperative pipeline call.
 
 Decide and record one of:
 1. **Internal ungated command** - only if the security design supports it: not reachable by
@@ -84,13 +85,10 @@ Decide and record one of:
    requirement in `STATE.md`.
 2. **Direct `produces`** - when no decision is left (the fact is already decided) and nothing
    should refuse it.
-3. **Gated command + trusted actor + recorded gap** - when the command must stay protected.
-   Keep the gate (a policy requiring the service role), name the role as the intended actor,
-   and record that Screenplay 4.66.0 cannot declare it. The reference rejects the caller-less invoke,
-   so the automation spec cannot pass: do not write a fake passing spec. Report V4 as "not run:
-   no route" (no available route executes these specs) and record the expected rejection and
-   the trusted-actor gap separately, citing the reaction semantics (a command that requires a
-   caller rejects the reaction).
+3. **Gated command + declared trusted actor** - keep the service-role policy and
+   declare matching `runs as system role` on the reaction. Reference-test the
+   scenario with standalone 4.125.0; separately record CLI/Stage target refusal.
+   A missing actor must not be excused by removing the gate or inventing a caller.
 Never remove an existing gate only to make a reaction spec pass.
 Omitting an HTTP route is not an authorization proof: the exposure requirement stays a target
 requirement with its negative case (an outside caller is refused).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/cases-to-specify.md

@@ -16,7 +16,7 @@ One spec in the slice does not cover the others.
 | queue opens / closes | item appears, item disappears | `then query …ById`; `when append <Closing>` + `then no readmodel … for` |
 | already done | trigger re-delivered after the result exists | `given <Result>` + `when <Command>` -> `then error "<fixed constraint message>"` |
 | invoked command rejects | validation or constraint refuses | command spec in its StateChange slice; record what the queue shows afterwards |
-| no caller | invoked command is gated | record the expected rejection and the actor decision (`automation-patterns.md` §4); V4 is "not run: no route" |
+| no declared actor | invoked command is gated | specify its denial; for the trusted path declare reaction `runs as system role` and reference-test with standalone 4.125.0 |
 | clock boundary | due exactly at the instant, just before, just after | `given clock` + `when clock`; boundary semantics are contested in the docs, mark the expectation as an assumption |
 | each branch | does every filter and conditional production have both outcomes? | concrete triggering and non-triggering values; assert the resulting facts or view |
 | denied actor | every command and query under an inherited module/feature `authorize` needs its own denial; also, can an unauthorized caller reach a gated invoked command by another origin? | command spec with otherwise-valid inputs, `given caller` carrying the wrong role/claim (or no caller) and `then denied`; separate from the caller-less reaction gap |
@@ -58,9 +58,9 @@ One spec in the slice does not cover the others.
   The decision must not depend on it (it is not protected).
 
 ## Spec limits (tool differences: `cratis-screenplay-toolchain` `references/versions.md`)
-- These Automation/Translate specs parse and bind (V3) on Screenplay 4.66.0, but no MCP tool,
-  `validate` or Stage render runs them (Stage renders no Automation or Translate slice). Report
-  V4 as "not run: no route"; never as passed.
+- Current admitted Automation/Translate specifications run through standalone
+  `screenplay test` or MCP `run-specifications`. Validate/render alone is not V4;
+  report unsupported/unbound separately from passing scenarios.
 - With Screenplay 4.66.0 (standalone or cratis 3.28.2), a command spec lists the cascade (v6 semantics: after
   `when <Command>`, `then` lists every new fact, including reaction appends). Only when a
   cratis before 3.28.2 bundle (4.60.1) is the V1 tool does it report a false PLAY0285 on a cascade (cli#242):

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/effects-and-idempotency.md

@@ -25,6 +25,27 @@ or reaction. Choose and record one of:
 Payments, legal notices and anything costly or irreversible: prefer 2 or 3 and an idempotency
 key; write a reconciliation case.
 
+## Refusal disposition and redelivery
+
+At Screenplay 4.125.0 an invocation can state ordered `on refused` selectors for
+validation, constraint (optionally named) or explicit authorization denial.
+Bare refusal does not include authorization. A matching branch declares a fact
+or leaf `acknowledge`; `$refusal.reason`/`.message` are String details and
+`.constraint` belongs only to constraint selectors. This is **authoring-only**
+(PLAY0268), not evidence that a duplicate was safely acknowledged at runtime.
+
+Recovery syntax `when redelivered <Event> to <Reaction>` selects exactly one
+existing given occurrence; it is not append or replay. `then no events` makes a
+no-new-facts contract explicit but remains unadmitted too. Full selectors,
+occurrence matching and checked source examples: captures-and-reactions
+`references/refusals-and-redelivery.md`.
+
+Infrastructure/contract errors, Unsupported and concurrency are never domain
+refusals. No `by concurrency` exists: fail/retry transient contention. Record the
+actual target's disposition, trusted actor, durable delivery identity and external
+idempotency/reconciliation owner. A branch or observer receipt alone proves no
+cascade transaction or exactly-once external effect.
+
 ## Retry identity
 - The retry must carry the same identity as the first attempt: the stream id chosen before
   the first try (never a fresh id per attempt), and the same idempotency key outward.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/provenance.md

@@ -40,5 +40,7 @@ Changes in this version: the examples are complete fenced documents that compile
 example's anonymous-booking spec gained the `given caller` PLAY0389 requires; the todo-list
 example's list query, `reads` and retry sweep moved to marked design-only excerpts so the core
 binds); tool-qualified verdict text; the trusted-actor text now names `[ExecuteCommandsAsSystem]`
-(Arc v20.56.0, available in a rendered app's Arc 22.25.0) and Screenplay#383; Stage renders no
-Automation or Translate slice (Stage#79).
+(Arc v20.56.0). Current actor syntax was reverified at Screenplay v4.125.0
+`reactions.md`, `ReactionIdentityParser.cs`, `ReactionRefusalValidator.cs` and the
+binder's v10 selection; the checked scenario passes reference execution. CLI
+3.41.0's older parser and Stage 4.51.3's v7 planner remain target limits.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/todo-list-example.md

@@ -13,7 +13,8 @@ The first spec lists the whole cascade (`then` names every new fact: `CoursePass
 `CertificateSent` through the reaction), and `given clock` supplies the instant that
 `$context.occurred` needs. Both 4.66.0 tools accept that cascade; the cratis 3.27.1 bundle reported a false PLAY0285 on it
 (cli#242). These specs were not
-run (V4: not run, no route); the expectations follow the v4.66.0 reference semantics.
+run in that historical probe; current admitted scenarios can be run with
+standalone `screenplay test` or MCP `run-specifications`.
 
 What the model proves and what it does not:
 
@@ -22,8 +23,10 @@ What the model proves and what it does not:
 - Not proven: that the certificate email reaches the person once. See
   `references/effects-and-idempotency.md`.
 - The actor behind `SendCertificate` is a recorded security decision in the `Certification`
-  module `description`, because reaction invocations carry no caller on Screenplay 4.66.0 (Screenplay#383).
-- No local engine runs Automation specifications: report them as authored, not as run.
+  module `description`: this example declares no reaction identity, so its
+  invocations remain caller-less. A gated trusted path can instead declare
+  `runs as system role` on 4.125.0 (ESM v10), with separate CLI/Stage refusal.
+- Report reference outcomes only after executing the selected scenarios.
 
 ```screenplay
 // Todo-list automation. Shape: CoursePassed opens an item -> CertificateSender invokes
@@ -101,7 +104,7 @@ module Courses
           for "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
 
 module Certification
-  description "Trusted background boundary. No persona or screen issues SendCertificate; only the CertificateSender reaction invokes it, and reaction invocations carry no caller. Leaving the command ungated is a SECURITY DECISION, accepted only because: (1) it appends a fact keyed to one enrolment, (2) a repeat is rejected by IssueOnce, (3) the realization must not expose it to external callers (requirement to verify in the target). If (3) cannot hold, gate it with a service-actor policy and record the capability gap instead (reaction invocations carry no caller: Screenplay#383)."
+  description "Trusted background boundary. No persona or screen issues SendCertificate; only the CertificateSender reaction invokes it, and reaction invocations carry no caller. Leaving the command ungated is a SECURITY DECISION, accepted only because: (1) it appends a fact keyed to one enrolment, (2) a repeat is rejected by IssueOnce, (3) the realization must not expose it to external callers (requirement to verify in the target). If (3) cannot hold, gate it with a service-actor policy and declare runs as system role on the reaction (ESM v10), retaining the CLI/Stage realization gap."
   feature Certificates
     slice StateView CertificatesToSend
       description "Work queue: membership means 'still to send'; there is no status flag"

package/package/corpus/skills/cratis-screenplay-automations-and-translations/verification.json

@@ -4,13 +4,13 @@
   "fixtures": [],
   "assertions": [
     { "kind": "skill-contains", "value": "`[ExecuteCommandsAsSystem(\"<role>\")]`" },
-    { "kind": "skill-contains", "value": "Screenplay#383" },
-    { "kind": "skill-contains", "value": "renders no Automation or Translate slice" },
-    { "kind": "skill-contains", "value": "never invent `runs as`" },
+    { "kind": "skill-contains", "value": "ESM v10" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-024" },
+    { "kind": "skill-contains", "value": "runs as system role" },
     { "kind": "skill-contains", "value": "**One meaning of Translation:**" },
     { "kind": "skill-contains", "value": "complete, open or blocked" },
     { "kind": "skill-contains", "value": "never write a mapping" },
-    { "kind": "skill-contains", "value": "V4 is \"not run: no route\"" },
+    { "kind": "skill-contains", "value": "run-specifications" },
     { "kind": "skill-contains", "value": "never skipped silently" },
     { "kind": "skill-contains", "value": "not applicable: no queue" }
   ]

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -32,16 +32,10 @@ source is the single flow model.
 | `Cratis.Screenplay` | main `fd18129` | Command-only inline event boundary |
 | `Cratis.Screenplay` | `4.66.0` (`c89198b`) | ESM v6: reactions, clock, trigger and capture specifications bind; `invokes` caller rule; probed with the standalone tool and its MCP server |
 
-The update follows `commands.md`, `events.md` and `diagnostics.md` at that main
-commit (after v4.52.0).
-
-Historical baseline evidence: the original examples were checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
-`Documentation/screenplay/{captures,captures/grammar,reactions,triggers,interactions,file-references,grammar,diagnostics}.md`
-and decisions 0003, 0006 and 0009; those original examples compiled with that
-version's compiler. The specification actions and ESM v6 text were checked at
-`v4.66.0` (see its row above), and the complete examples here and in
-`references/complete-examples.md` compile with the standalone 4.68.0 compiler.
-Reverify before claiming another version behaves the same.
+The table records historical examples/probes; they are not reclassified as
+current execution evidence. Refusal/redelivery guidance follows released
+v4.125.0 `reactions.md`/`specifications.md`. Current pins are in toolchain
+`references/versions.md`; reverify before promoting an old probe to that version.
 
 ⚠️ **Which tool admits them depends on its Screenplay version.** The ESM level
 decides, not the slice type:
@@ -50,14 +44,10 @@ decides, not the slice type:
   `Translate` slices, reactions, declared triggers and captures bind, and the
   reference runner executes them. Probed: the complete example below is
   `executableReady` over `screenplay mcp`.
-- **`cratis` 3.28.2 (bundles Screenplay 4.66.0, ESM v1-v6):** the same as the standalone
-  tool. Probed: the complete examples validate with warnings as errors and are
-  `executableReady` over `cratis screenplay mcp`. `cratis` before 3.28.2 (Screenplay
-  4.60.1, ESM v1-v5) failed an `Automation` or `Translate` slice at binding with `PLAY0268`
-  (*Slice '<name>' of type '<type>' is not admitted by ESM v1*), reported reactions as
-  *requires portable occurrence and effect semantics* and captures as *require a portable
-  compiled CDL plan*, and gave a false `PLAY0285` on a specification that follows a reaction
-  cascade (Cratis/cli#242).
+- **Historical CLI 3.28.2 / Screenplay 4.66.0 probe:** complete examples validated
+  and were executableReady through MCP. Earlier 4.60.1 bundles refused v6 at
+  binding and falsely reported PLAY0285 on cascades. Toolchain `references/versions.md`
+  separates that history from current pins.
 - **Stage 4.24.2** admits ESM v1-v4 and renders no `Automation` or `Translate`
   slice. The automation is gap-fill, with the `.play` slice and its specifications
   as the contract: `cratis-screenplay-render-and-gap-fill`.
@@ -69,25 +59,26 @@ Method (the four-part automation test, loops, translations versus automations):
 
 ## Specify what sets them off
 
-A specification names what sets the automation off: `when clock`, `when trigger` or `when capture`. No command runs these specifications; report one as authored, not executed.
+A specification names what sets the automation off: `when clock`, `when trigger`
+or `when capture`. Execute admitted scenarios through `screenplay test` or MCP
+`run-specifications`; source compilation alone is only authored evidence.
 
 Read [references/specifying-triggers-and-clock.md](references/specifying-triggers-and-clock.md) when writing a specification for a reaction, trigger or capture, or when the clock, occurrence or limit rules matter.
 
 ## Caller-less invokes and unprotected reads
 
-**Who is the caller of an `invokes`?** Nobody. In the reference execution the invoked
-command runs its full pipeline - authorization, validation, requirements,
-constraints - **with no caller**; a command that needs one rejects, and the
-rejection ends the scenario. Each invoked command is atomic, but the cascade is not,
-so facts accepted earlier remain. There is no syntax for a trusted identity in the verified Screenplay versions
-(Screenplay#383, open): never invent `runs as` or a `given caller` for a reaction.
-Say so in the model: a `description` on the reaction that names the trusted actor
-the target must use. At code level a rendered or hand-written target runs such a
-command as the system with `[ExecuteCommandsAsSystem]` (Arc 20.56.0 and later, so
-also in a rendered application's Arc 22.25.0). An authorized command a reaction
-invokes needs that decision made explicit, in the model's description and in the
-gap-fill code, not left to a rejection nobody expected. Cascades and their
-specification limits: `cratis-screenplay-specifications`.
+**Who is the caller of an `invokes`?** Without a declared actor, nobody.
+Screenplay 4.125.0 supports reaction-level `runs as system role "<Role>"`
+(optional roles, joined with `and role`). It selects ESM v10 and supplies the
+reference invocation's authenticated system principal with exactly those roles;
+`given caller` does not supply it. Keep gates and declare the least-privilege actor.
+Read [invocation identity](references/invocation-identity.md) for the checked
+scenario, claim/unknown semantics and PLAY0647–0652/0557 diagnostics.
+
+CLI 3.41.0's 4.114.0 compiler rejects this source with PLAY0137; its version gate
+and Stage 4.51.3 planner admit only through v7. Target realization is gap-fill,
+using Arc `[ExecuteCommandsAsSystem]` for returned commands. Each invoked command
+is atomic, not the whole cascade; earlier accepted facts remain after a later refusal.
 
 ⚠️ **Declared, not enforced.** A trigger `reads` gives no runtime protection. From
 ESM v6 the binder refuses to treat it as one: a trigger with `reads` that **produces
@@ -101,9 +92,19 @@ the input selection or not; nested paths and read aliases fail binding): keep th
 the invoked command or the implementation. Under `cratis` before 3.28.2 none of this
 bound at all (`PLAY0268`); `cratis` 3.28.2 binds it like the standalone tool.
 
+## Refusals and recovery redelivery
+
+At 4.125.0, invocation refusal selectors, `$refusal` branch values,
+`acknowledge`, `when redelivered ... to ...` and `then no events` are valid
+authoring intent but refuse binding with PLAY0268. Read
+[refusals and redelivery](references/refusals-and-redelivery.md) for first-match
+selectors, typed values, occurrence matching, diagnostics and the checked
+unbound example. Never acknowledge infrastructure or concurrency failures.
+
 ## Complete example (ESM v6)
 
-One document with every construct (application trigger, reactions on an event, a trigger, a view read and the clock, and a capture with specifications) is kept in the reference file.
+The reference document covers v6 triggers, event/clock reactions, view reads and
+capture specifications. Refusal/redelivery forms use their separate checked reference.
 
 Read [references/complete-examples.md](references/complete-examples.md) when you need a complete, compiling parent document for an excerpt or want to check the authoring and binding prerequisites.
 
@@ -338,7 +339,8 @@ something is reported. `Startup` and `Shutdown` are registered the second way.
       `PLAY0268` at binding and a false `PLAY0285` on cascade specifications, and report them
       as tool skew.
 - [ ] The tool that bound the model is named (Screenplay 4.61 or later, so standalone or
-      `cratis` 3.28.2 or later, for ESM v6 constructs); no tool runs the specifications.
+      `cratis` 3.28.2 or later, for ESM v6 constructs); reference scenarios use
+      `screenplay test`/MCP. Unadmitted refusal/redelivery is not executed evidence.
 - [ ] Each automation has all four components — occurrence, state consulted,
       conditional logic, resulting command or event. If it always fires
       unconditionally it is co-production, not an automation.
@@ -351,8 +353,8 @@ something is reported. `Startup` and `Shutdown` are registered the second way.
       value the trigger takes, and clock triggers read without `by`.
 - [ ] Nobody reports trigger or command `reads` as protected; UI clicks are
       interactions, not triggers.
-- [ ] Every `invokes` of an authorized command names the trusted actor in a
-      description; no caller is invented for a reaction.
+- [ ] Every gated invocation declares its trusted actor with reaction `runs as`
+      (ESM v10) or records the target gap explicitly; `given caller` is not that actor.
 
 ## Route near misses
 

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/complete-examples.md

@@ -97,7 +97,7 @@ module Delivery
 
 ## Reaction with `produces` and `invokes`
 
-Parent of the `Provisioner` excerpt. The invoked command runs with no caller in the
+Parent of the `Provisioner` excerpt. The reaction declares no `runs as system`, so the invoked command runs with no caller in the
 reference execution.
 
 ```screenplay